Coprocessor Jump Address Encryption for Buffer Overflow Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security mechanisms, such as ASLR and DEP, are inadequate in defending against complex buffer overflow attacks, as they can be bypassed through techniques like Ret2libc attacks and modification of pointer variables.
Innovation Solution
A security defending method and apparatus that utilize a coprocessor to perform encryption and authentication operations on jump destination addresses, employing mask configurations to process and authenticate address values, thereby preventing unauthorized modifications and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ASLR mechanism is used to randomize memory addresses, then difficulty for attackers to jump to specific memory location is increased, but relative addresses between library functions remain unchanged allowing Ret2libc attacks
Solution Approach 1:
The patent applies parameter changes by transforming the jump destination address through encryption operations. The original address value is modified by performing cryptographic transformations (such as XOR with key material or hash-based obfuscation) to produce an encrypted address value. This changes the parameter representation from plaintext to ciphertext, making it unreadable and unusable for attackers even if they intercept or leak the address data.
Solution Approach 2:
The patent introduces an intermediary encryption mechanism between the address generation and address usage stages. Instead of directly using the jump destination address, the system passes it through an encryption module that acts as an intermediary, transforming the address into an encrypted form. This intermediary layer ensures that even if the address is leaked or intercepted, it cannot be used without the corresponding decryption key, thus preventing Ret2libc attacks while maintaining ASLR's address randomization benefits.
2Reliability
If DEP mechanism is used to set non-executable data segments, then execution of injected malicious programs is prevented, but attackers can use existing code segments to construct return addresses for Ret2libc attacks
Solution Approach 1:
The patent applies preliminary action by encrypting the jump destination address in advance before it is used for control flow transfer. The encryption operation is performed proactively during address generation or before the jump instruction is executed, ensuring that the address is already obfuscated before any potential attack vector can exploit it. This preliminary encryption prevents attackers from constructing valid return addresses even if they have access to existing code segments, as the addresses are transformed into unusable encrypted forms.
3Measurement precision
If Stack Canary mechanism is used to insert Canary Word between buffer and return address, then overflow detection capability is improved, but system functions allowing Canary Word writing make overflow attacks still feasible
Solution Approach 1:
The patent applies the copying principle by creating and using multiple encrypted representations of the jump destination address. Instead of relying on a single Canary Word that can be overwritten, the system generates encrypted address values that are distributed and verified through multiple copies. The encryption process creates redundant secure representations of the address, ensuring that even if one instance is compromised or overwritten, the encrypted integrity checks can detect the tampering and prevent the attack.
4Reliability
If encryption operations are performed on jump destination addresses, then buffer overflow attack resistance is improved, but computational overhead and processing time increase
Solution Approach 1:
The patent applies segmentation by dividing the address encryption process into distinct modular stages. The address transformation is broken down into separate operations such as key selection, cryptographic transformation, and verification stages, each handled by dedicated hardware or software modules. This segmentation allows the encryption operations to be performed efficiently in parallel or pipelined fashion, reducing the overall computational overhead and minimizing impact on system processing efficiency while maintaining strong security defense capabilities.
Data Source
AI summary
A security defending method, a coprocessor, and a processing apparatus are disclosed. The security defending method is applicable in a coprocessor, including: receiving a jump destination encryption request for the operation task; using mask configuration to perform first mask processing on the first jump destination address value to obtain a first intermediate jump destination address value; performing an authentication operation based on the first jump destination storage address, a key reference value corresponding to the operation task and the first intermediate jump destination address value, to obtain a first encryption result value; using the mask configuration to perform second mask processing on the first encryption result value to obtain a first intermediate encryption result value; performing an authentication operation on the first intermediate encryption result value and the first jump destination address value to obtain a first encryption jump destination address value.